The DLL Services component in Mozilla Firefox and Thunderbird contains an improper privilege management flaw that allows attackers to elevate privileges. The updated description confirms that manipulating DLL loading or executing code that interacts with this component enables a lower‑privileged process to gain higher rights, potentially executing arbitrary code. Such a privilege escalation compromises system integrity, confidentiality, and availability.

This vulnerability affects Mozilla Firefox and Thunderbird across both Extended Support Release (ESR) and regular versions. It was confirmed to have been fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 140.17, Thunderbird 157, Thunderbird 153.4, and Thunderbird 140.17. All releases older than these specific builds remain vulnerable.

The CVSS score of 8.8 classifies this vulnerability as high severity, while the EPSS score of < 1% indicates a very low probability of exploitation at this time. The flaw does not appear in the CISA KEV catalog, so no confirmed public exploitation has been reported. The likely attack vector, inferred from the nature of DLL Services, would involve local execution or manipulation of DLL loading to inject malicious code, although the precise conditions are not detailed in the description.